CVE-2024-8376

HIGH EPSS 50.2%

Published Oct 11, 20241y ago · Modified Jun 17, 20262w ago

7.2 CVSS 4.0

High

Published Oct 11, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

CVSS Details

Base Score

7.2

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

50.2% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 3

CWE-401

CWE-416 Use After Free Memory Safety

CWE-755

Affected Products 1

Vendor	Product	Version	Range
eclipse	mosquitto	*	<2.0.19

References 8

github.com https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17

Patch
github.com https://github.com/eclipse/mosquitto/releases/tag/v2.0.19

PatchProduct
gitlab.eclipse.org https://gitlab.eclipse.org/security/cve-assignement/-/issues/26

Issue Tracking
gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216

Issue Tracking
gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217

Issue Tracking
gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218

Issue Tracking
gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227

Issue Tracking
mosquitto.org https://mosquitto.org/

Product

Remediation

github.com https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17

Patch
github.com https://github.com/eclipse/mosquitto/releases/tag/v2.0.19

PatchProduct